Home / vulnerabilities MDVSA-2009-327.txt
Posted on 08 December 2009
Source : packetstormsecurity.org Link
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:327
http://www.mandriva.com/security/
_______________________________________________________________________
Package : clamav
Date : December 8, 2009
Affected: 2008.0
_______________________________________________________________________
Problem Description:
Multiple vulnerabilities has been found and corrected in clamav:
Unspecified vulnerability in ClamAV before 0.95 allows remote
attackers to bypass detection of malware via a modified RAR archive
(CVE-2009-1241).
libclamav/pe.c in ClamAV before 0.95 allows remote attackers to cause
a denial of service (crash) via a crafted EXE file that triggers a
divide-by-zero error (CVE-2008-6680).
libclamav/untar.c in ClamAV before 0.95 allows remote attackers to
cause a denial of service (infinite loop) via a crafted file that
causes (1) clamd and (2) clamscan to hang (CVE-2009-1270).
The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1
allows remote attackers to cause a denial of service (application
crash) via a malformed file with UPack encoding (CVE-2009-1371).
Stack-based buffer overflow in the cli_url_canon function in
libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers
to cause a denial of service (application crash) and possibly execute
arbitrary code via a crafted URL (CVE-2009-1372).
Important notice about this upgrade: clamav-0.95+ bundles support
for RAR v3 in libclamav which is a license violation as the RAR v3
license and the GPL license is not compatible. As a consequence to
this Mandriva has been forced to remove the RAR v3 code.
Packages for 2008.0 are being provided due to extended support for
Corporate products.
This update provides clamav 0.95.2, which is not vulnerable to these
issues. Additionally klamav-0.46 is being provided that has support
for clamav-0.95+.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6680
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1241
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1270
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1371
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1372
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.0:
d4e8e17141e413c9e87a64b7181627e2 2008.0/i586/clamav-0.95.2-0.1mdv2008.0.i586.rpm
9179be11ae65a206e3b1c6075836db93 2008.0/i586/clamav-db-0.95.2-0.1mdv2008.0.i586.rpm
4d3b2e34434bb8ff057205f3575900a4 2008.0/i586/clamav-milter-0.95.2-0.1mdv2008.0.i586.rpm
377e99d065097abc4b8a7e4817f4f9f1 2008.0/i586/clamd-0.95.2-0.1mdv2008.0.i586.rpm
253062120fa32d9d42c9058516a72153 2008.0/i586/klamav-0.46-0.1mdv2008.0.i586.rpm
9ef37702dc560d9941d982cfffeea6af 2008.0/i586/libclamav6-0.95.2-0.1mdv2008.0.i586.rpm
b9aa169bb1ef5fcad2e59deea2cfbb41 2008.0/i586/libclamav-devel-0.95.2-0.1mdv2008.0.i586.rpm
b9a99dc63a69f9b4203fb95bc5d5ff12 2008.0/SRPMS/clamav-0.95.2-0.1mdv2008.0.src.rpm
6a46b5c8bbf5429512e4b1924243526e 2008.0/SRPMS/klamav-0.46-0.1mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64:
4ac8f83b42541e50585c6ee6abd96ba8 2008.0/x86_64/clamav-0.95.2-0.1mdv2008.0.x86_64.rpm
a1281d397120c7404f05d952dfa117b7 2008.0/x86_64/clamav-db-0.95.2-0.1mdv2008.0.x86_64.rpm
8c1dc967687df31c29a01a43fcc487ed 2008.0/x86_64/clamav-milter-0.95.2-0.1mdv2008.0.x86_64.rpm
109b738b88ebb607d2456ea1797d48cd 2008.0/x86_64/clamd-0.95.2-0.1mdv2008.0.x86_64.rpm
b3dcaa53da6e1413924e2f1f3c611854 2008.0/x86_64/klamav-0.46-0.1mdv2008.0.x86_64.rpm
2b7975248a809f3cfe9a2c5c7f0719f1 2008.0/x86_64/lib64clamav6-0.95.2-0.1mdv2008.0.x86_64.rpm
3068f027586ef92661f8a6c60fd6ea3e 2008.0/x86_64/lib64clamav-devel-0.95.2-0.1mdv2008.0.x86_64.rpm
b9a99dc63a69f9b4203fb95bc5d5ff12 2008.0/SRPMS/clamav-0.95.2-0.1mdv2008.0.src.rpm
6a46b5c8bbf5429512e4b1924243526e 2008.0/SRPMS/klamav-0.46-0.1mdv2008.0.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFLHlb7mqjQ0CJFipgRArB7AJ96vycVt/sc1YDwjmFkzl20gzfsRQCgsJEp
0vt39CYEd6o0ENF/6xMWYis=
=VxRu
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
